"service logstash start" does not work


(X Calibur) #1

Hi,

I have Ubuntu 16.10 and the latest Logstash installed.
Running Logstash manually with /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" works just fine but I'm unable to run it as a service.
Any help would be greatly appreciated.

Thanks,
X


Why doesn’t logstash run as a deamon?
(Mark Walkom) #2

What do the logs say?


(Pablo) #3

check what sudo services logstash status says
It will usually explain why the service didn't start


(X Calibur) #4

logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset:
Active: active (running) since Thu 2017-04-20 10:49:23 IDT; 1min 24s ago
Main PID: 5036 (java)
Tasks: 17 (limit: 4915)
Memory: 315.5M
CPU: 24.560s
CGroup: /system.slice/logstash.service
└─5036 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMS

Apr 20 10:49:23 PRIL1ELK02 systemd[1]: Started logstash.


(X Calibur) #5

Even though it shows as being running...well, it just does not.
it does not load my beats config file unless I run it manually.
And the logs are NOT being written to.
Only showing stuff when the manual command is being run.


(Mark Walkom) #6

That doesn't look like the LS log, from /var/log/logstash/?


(X Calibur) #7

/var/log/logstash/
does not show anything when running the "service logstash start" command.


(Pablo) #8

Check where your logstash.conf is https://www.elastic.co/guide/en/logstash/current/running-logstash.html
maybe is not picking it up


(X Calibur) #9

You mean logstash.yml or the beats.conf?

logstash.yml is at
/etc/logstash

beats.conf
/etc/logstash/conf.d


(Pablo) #10

I meant logstash.conf
check your systemd config (if you are using systemd) should be in /etc/systemd/system
and will look like this where you will have the location of the logstash.conf


(X Calibur) #11

I found the following:

root@PRIL1ELK02:/etc/systemd/system# cat logstash.service
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash

Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.

Prefixing the path with '-' makes it try to load, but if the file doesn't

exist, it continues onward.

EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
EnvironmentFile=-/etc/logstash/startup.options
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target


(Pablo) #12

I am not completely sure about this, but the ExecStart should point to your logstash.conf file also, something like:

ExecStart=/usr/share/logstash/bin/logstash "-f /etc/logstash/logstash.conf" "--path.settings" "/etc/logstash"


(X Calibur) #13

I do not have a "logstash.conf" file anywhere.


(Pablo) #14

Oh well, that explains a lot :smile: make sure to have one if you want Logstash to do something.


(X Calibur) #15

Not really.
I think what you refer to as "logstash.conf" is my "beats.conf".

Anyway just came to say that my problem all long was permissions.
/etc/logstash was taken by root ever since I installed Xpack I believe.

Now the service works as it should.


(system) #16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.